Struct ActionsPinnedDependenciesControl 

pub struct ActionsPinnedDependenciesControl;

Validates that GitHub Actions workflow uses: references are pinned to commit SHAs.

Maps to SOC2 CC7.1 / PI1.4: prevent supply-chain attacks via mutable action tags. Unpinned action references (e.g. actions/checkout@v4) can be silently replaced by a compromised upstream, whereas SHA-pinned references are immutable.

Evaluation:

• Satisfied: no unpinned action references found
• Violated: one or more workflow files contain unpinned uses: references

Trait Implementations

impl Control for ActionsPinnedDependenciesControl

fn id(&self) -> ControlId

Returns the unique identifier for this control.

fn description(&self) -> &'static str

Human-readable description for SARIF rule output.

fn evaluate(&self, evidence: &EvidenceBundle) -> Vec<ControlFinding>

Evaluates the evidence bundle and returns one finding per subject.

fn tsc_criteria(&self) -> &'static [&'static str]

SOC2 Trust Services Criteria this control maps to (e.g., &[“CC6.1”, “CC8.1”]). Returns empty slice for controls not mapped to SOC2.